Anyone paying attention to this? "Month of Apple Bugs"

[timg]

http://projects.info-pull.com/moab/

second one isn't even apple code, it's VLC.

[elmo3]

The second one *is* Apple code.

"A format string vulnerability exists in the handling of the udp:// URL handler. By supplying a specially crafted string, a remote attacker could cause an arbitrary code execution condition, under the privileges of the user running VLC."

The Apple code dealing with the udp:// URL handler is such that a specially crafted string by a remote attacker could cause arbitrary code execution under the privileges of the user running VLC.

It's not VLC itself; it's Apple's code.

[Pat]

FAQ on the linked page.

3. Are Apple products the only one target of this initiative?
Not at all, but they are the main focus. We'll be looking over popular OS X applications as well.

[M A V I C]

[quote elmo3]The second one *is* Apple code.

"A format string vulnerability exists in the handling of the udp:// URL handler. By supplying a specially crafted string, a remote attacker could cause an arbitrary code execution condition, under the privileges of the user running VLC."

The Apple code dealing with the udp:// URL handler is such that a specially crafted string by a remote attacker could cause arbitrary code execution under the privileges of the user running VLC.

It's not VLC itself; it's Apple's code.
Did you miss this part?
Affected versions
This issue has been successfully exploited in VLC version 0.8.6 for Mac OS X. Previous versions and other platforms might be affected (thanks to David Maynor for confirming the issue in the Microsoft Windows version).

If it's Apple's code, why does the exploit also apply to Windows?

And if uninstalling VLC is a fix for this situation, how does that not make it a VLC issue?

[mikebw]

As an aside, wouldn't the Windows equivalent be something like a hundred years of Bugs?

[timg]

well, 3 days into the month and it seems they have run out of bugs already ... or at least they forgot to update their site today.